Logstash does not listen for beats

Elastic Stack Logstash
1

Hello, it appears that logstash fails to listen on 5044.

My config:

# egrep -v '#|^$' logstash.yml
path.data: /var/lib/logstash
path.config: /etc/logstash/conf.d/*.conf
path.logs: /var/log/logstash

# cat conf.d/beats.input.conf
input {
beats {
port => 5044
}
}

Tailing syslog, since logstash does not log otherwise, despite 'path.logs: /var/log/logstash' being set in logstash.yml, I see the start/stop in syslog but no other info and no error output of any kind, nor any indicator that it is reading or not reading conf.d.

Logstash does not throw any errors, it simply does not listen. I have tried updating the beats plugin but no luck.

What is the deal? this is a very frustrating problem which has been raised in many other threads, but never with a resolution appearing in any thread (except the plugin update, which was actually a bug with logstash not honoring host setting).

I have elasticsearch on the same server, listening on 9200 with no problems. I stopped elasticsearch and set logstash to listen on that port via beats.conf. Once again, logstash simply does not listen. This is not a local network or firewall issue.

Please help with this very frustrating problem.

2

Update: I put the config from beats.input.conf into logstash.yml and restarted again. Still nothing. No results at all. Logstash just doesn't listen period.

Very surprising to see this complete fail when the rest of the stack is so easy to get up and running. I am at the point of wanting to simply leave logstash out of the picture. Is it just that kafka should be used for the beats to send to, so that logstash listening issues are not addressed? I can't believe with all these threads for the same issue, there is no resolution anywhere.

3

Update: I put the config from beats.input.conf into logstash.yml and restarted again. Still nothing. No results at all. Logstash just doesn't listen period.

If you put the contents of beats.input.conf in logstash.yml I find it hard to believe that Logstash is starting up at all if Logstash is reading the logstash.yml you think it's reading. So, the problem you should debug is rather "why isn't Logstash reading my configuration at all". How are you starting Logstash? Where is the logstash.yml you want to use? If you start Logstash from a shell it should log to stdout.

4

After downloading the latest version of logstash and installing manually, I no longer have this problem. I created my own conf file based on the documentation and it listens with no problems.

The installation I was having trouble with was from the debian repo installed via apt-get.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.